A timing discrepancy vulnerability in the Tinyauth authentication server allows unauthenticated attackers to enumerate valid usernames, increasing the risk of successful credential-based attacks.

The application exhibits an observable timing discrepancy (CWE-208) in the loginHandler and basicAuth functions. An unauthenticated attacker can measure the time difference between responses to determine if a username exists, as the system processes existing users differently than nonexistent ones during bcrypt verification.

This vulnerability presents a significant risk to account security by enabling user enumeration. With valid usernames confirmed, an attacker can focus brute-force or credential-stuffing efforts on existing accounts, leading to unauthorized access and potential data compromise. While the CVSS score of 6.9 reflects a medium severity, the ability to facilitate further exploitation elevates the urgency for organizations relying on Tinyauth for identity management.

Immediate Action: Update the Tinyauth package to version 5.1.0 or the specified Go module version (1.0.1-0.20260714134959-c22925c2fba9) to implement constant-time authentication checks.

Proactive Monitoring: Review authentication logs for patterns of high-frequency requests targeting specific usernames or unusual spikes in failed login attempts.

Compensating Controls: If immediate patching is not feasible, implement strict rate limiting on the login endpoint to hinder the ability of an attacker to perform the repeated measurements required for timing analysis.

Public Exploit Available: No confirmed public exploit exists in the provided data.

Organizations using Tinyauth must prioritize the update to version 5.1.0 to eliminate the timing discrepancy. Given the potential for this flaw to serve as a precursor to more severe account takeover attacks, administrators should treat this update as a high-priority maintenance task to ensure the integrity of the authentication process.